FS-444: Limit TLS ciphers to TR-02102-2 compatible ciphers

[comawill]

https://wearezeta.atlassian.net/browse/FS-444

Checklist

• The PR Title explains the impact of the change.
• The PR description provides context as to why the change should occur and what the code contributes to that effect. This could also be a link to a JIRA ticket or a Github issue, if there is one.
• If HTTP endpoint paths have been added or renamed, the endpoint / config-flag checklist (see Wire-employee only backend wiki page) has been followed.
• If a cassandra schema migration has been added, I ran make git-add-cassandra-schema to update the cassandra schema documentation.
• changelog.d contains the following bits of information (details):
  • A file with the changelog entry in one or more suitable sub-sections. The sub-sections are marked by directories inside changelog.d.

[jschaul]

Could you add a one liner to the changelog? Something like

echo "Change the default set of TLS ciphers (both for the client and the federation APIs) to be compliant to the recommendations of TR-02102-2." > ./changelog.d/0-release-notes/TR-02102-2
git add ./changelog.d/0-release-notes/TR-02102-2

Otherwise looks good! 🚀

[jschaul]

Can you entirely remove the lines of code, rather than leaving them commented out?

Also, if this applies a general recommendation, could you link to the recommendation (perhaps this is about https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-2.html ?) in a comment above the blessedCiphers definition for future reference?

[jschaul]

I added some comments linking to the relevant docs.